Extracted text (via pymupdf_layout)
6104 characters
EXHIBIT I HOSTING REQUIREMENTS 1.0 AVAILABILITY: 1.1 Any information systems required for proper functionality of the hosted application must have 99.5% uptime during County business hours (as defined by the business unit). Uptime measurements must be met for all servers and their connectivity to the Internet or dedicated connection to the County, whichever is applicable. 1.2 An industry-recognized backup methodology must be employed, including the use of off-site storage. Contractor must make backup procedures and logs available at any time upon request from the County. 2.0 CONNECTIVITY: 2.1 Contractor shall provide connectivity to the Internet or use Virtual Private Networking (VPN), whichever is appropriate. The County shall not be financially responsible for networking equipment at the Contractor’s site. 3.0 DATA SECURITY: 3.1 Backups to removable media must be encrypted using the Advanced Encryption Standard (AES) with a minimum of a 128 bit key. Industry recognized key handling procedures must be utilized. At no time shall the key be stored on the backup media in clear text, including but not limited to table labels. Contractor must make key handling procedures and logs available upon request. 3.2 Hosted applications must support encrypted protocols for sensitive data. Preferred encryption protocols are Transport Layer Security (TLS). Encryption ciphers must use at least a 128 bit key length. Hashing algorithms used must be of the Secure Hash Algorithm (SHA) family. The minimum acceptable algorithm shall be SHA- 1. 3.3 All hosted applications must be audited by a third party at least once per year. Contractor must provide annual testing and audit reports by a 3rd party and furnish to County upon request. 3.4 All applications hosting Maricopa County data must undergo a risk assessment at least annually. The risk assessment must include System and application testing. Maricopa County will, on a periodic basis, perform security scans utilizing a third-party industry standard tool. Maricopa County and Contractor will collaborate on reviewing the findings generated by the tool. Contractor agrees to remediate high and medium vulnerabilities within a reasonable amount of time as agreed to with the Maricopa County Office of Information Security. 3.5 Contractor must maintain a non-disclosure agreement (NDA) with the County. All employees and partners of Contractor must maintain an NDA with Contractor for all services relating to this Contract. 3.6 All employees of Contractor must complete a federal, state, and local criminal background check. 3.7 No County data shall be transferred or made available to a 3rd party in unencrypted form without the express, written consent of the County. See the “Backups” section 3.1 for what shall be considered “encrypted.” 3.8 No County data shall be transferred or transmitted outside the United States for any reason without the express, written consent of the County. 3.9 The System must support password policy enforcement, such as mixed case, numerals, and non-alphanumeric characters and forced expiration. 3.10 The System must support the ability to disable or lock out user accounts after a given number of login failures. 4.0 INFORMATION SYSTEMS AUDITING: 4.1 The System must log all material user actions, including but not limited to, logon and log off. 4.2 The System must log all material administrator actions, including but not limited to, user creation, user deleting, password resets, and privilege level changes. 4.3 The System must log failed login attempts. 4.4 Logs must be made available to the County at any time. 5.0 BREACH NOTIFICATION: 5.1 Contractor must report all suspected breaches to the County immediately and in writing. Contractor must also fully cooperate with any County investigation into the breach, unless prohibited by law. 5.2 To the extent a breach of the hosted System occurs that is directly attributable to a negligent or intentional act by a party (“Responsible Party”), the Responsible Party shall incur the cost of breach notification and reasonable and industry customary follow-up services. Follow-up services shall, include credit monitoring of affected individuals. Should either party become aware of a breach of the System by a third party, the party with knowledge of the breach must immediately notify the other party. In the event of a third party breach, Contractor shall be responsible for notifying affected employees and procuring follow-up services, unless otherwise requested by EBH. 5.3 Breach notification requirements shall be determined by all applicable laws and contracts including, but not limited to, Arizona Revised Statutes 44-7501, California SB 1386, the Health Insurance Portability and Accountability Act (HIPAA). 5.4 Contractor shall make its information security incident response policy and procedure available to the County at any time upon request. 6.0 COMPLIANCE: 6.1 Contractor must comply with all applicable laws, regulations, and contracts including (but not limited to) Criminal Justice Information Systems (CJIS), and Health Insurance Portability and Accountability Act (HIPAA). 6.2 Contractor must make compliance reports, audit findings, and 3rd party attestations available at any time to the County upon request. Contractor must immediately notify the County, in writing, upon a confirmed violation of the compliance requirement. The notification must include any information provided by the regulatory body. 7.0 DATA RETENTION: 7.1 Contractor shall destroy all offline copies of County data at the time the copies cease to be useful, except for backup copies which are retained for eight years. Destruction procedures must be made available to the County upon request. 7.2 At the conclusion of the Contract, all Maricopa County data and working papers must be returned to the County, and all copies destroyed except for within backup copies which are retained for eight years. Contractor must confirm in writing to the County that all data was destroyed in accordance with this provision and state the method of destruction used.